test_malicious_payload_not_instantiated() — langchain Function Reference

Architecture documentation for the test_malicious_payload_not_instantiated() function in test_serializable.py from the langchain codebase.

Function python LangChainCore ApiManagement

Entity Profile

LangChainCore→ ApiManagement→ test_malicious_payload_not_instantiated() — langchain Function Reference

Dependency Diagram

graph TD
  822e55fc_290f_8fbc_606a_e45a85e0a0af["test_malicious_payload_not_instantiated()"]
  a193f10f_1a60_b879_b342_d29b1680b3e6["TestEscaping"]
  822e55fc_290f_8fbc_606a_e45a85e0a0af -->|defined in| a193f10f_1a60_b879_b342_d29b1680b3e6
  style 822e55fc_290f_8fbc_606a_e45a85e0a0af fill:#6366f1,stroke:#818cf8,color:#fff

Relationship Graph

Source Code

libs/core/tests/unit_tests/load/test_serializable.py lines 452–483

    def test_malicious_payload_not_instantiated(self) -> None:
        """Test that malicious LC-like structures in user data are NOT instantiated."""
        # An attacker might craft a payload with a valid AIMessage structure in metadata
        malicious_data = {
            "lc": 1,
            "type": "constructor",
            "id": ["langchain", "schema", "document", "Document"],
            "kwargs": {
                "page_content": "test",
                "metadata": {
                    # This looks like a valid LC object but is in escaped form
                    "__lc_escaped__": {
                        "lc": 1,
                        "type": "constructor",
                        "id": ["langchain_core", "messages", "ai", "AIMessage"],
                        "kwargs": {"content": "injected message"},
                    }
                },
            },
        }

        # Even though AIMessage is allowed, the metadata should remain as dict
        loaded = load(malicious_data, allowed_objects=[Document, AIMessage])
        assert loaded.page_content == "test"
        # The metadata is the original dict (unescaped), NOT an AIMessage instance
        assert loaded.metadata == {
            "lc": 1,
            "type": "constructor",
            "id": ["langchain_core", "messages", "ai", "AIMessage"],
            "kwargs": {"content": "injected message"},
        }
        assert not isinstance(loaded.metadata, AIMessage)